Improper Authorization in Keycloak - CVE-2026-2733
Published: September 10, 2026
Vulnerability identifier: #VU148921
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-2733
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to obtain authentication tokens for a disabled Docker registry client.
The vulnerability exists due to improper authorization in the Docker v2 authentication endpoint when processing token requests for an administratively disabled Docker registry client. A remote privileged user can use previously valid credentials to obtain authentication tokens for a disabled Docker registry client.
Affected software
Keycloak
Red Hat build of Keycloak
Red Hat build of Keycloak
How to mitigate CVE-2026-2733
Install security update from vendor's website.
Keycloak - update to 26.5.4
Red Hat build of Keycloak - update to 26.4.10
Red Hat build of Keycloak - update to 26.4.10